Erudika scoold

• CVE-2026-57183 Medium 6.1 Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs 0.3%
• CVE-2026-55840 Medium 5.4 Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass 0.3%
• CVE-2026-55842 Medium 5.4 Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain 0.1%
• CVE-2026-54676 Medium 6.5 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled 0.4%
• CVE-2026-54677 Medium 6.5 Scoold: Authenticated user can post replies and comments to private-space questions without space membership 0.4%
• CVE-2026-42176 Medium 6.7 Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation) 0.3%
• CVE-2026-39354 Medium 6.5 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask 0.2%
• CVE-2026-34832 Medium 6.5 Scoold: Cross-Account Feedback Deletion (IDOR) 0.3%
• CVE-2024-50334 High 8.7 Semicolon Path Injection on API /api;/config 1.0%